Tags: crypto 

Rating:

The flaw in the program is that it uses the same random values for Shahmir Secret Sharing, hence all the polynomials differ by only the constant term. We can cancel out the higher order terms in the polynomial and realise that y1 - y0 = x1 - x0, where yi is one of the shares of the ith character and xi is the ith character.

Since we now know the relative values of each character in the secret we can add different offsets to find the secret.

Original writeup (https://dowsll.github.io/writeups/polictf2017/splyt).